{"id":"cisco-sdwan-manager-file-overwrite-feb-2026","category":"patch","status":"closed","title":"Cisco Catalyst SD-WAN Manager file-overwrite flaw CVE-2026-20122 exploited; fixes available","tldr":"Attackers exploited CVE-2026-20122 in Cisco’s business network-management software, including in chains that installed backdoors. Ask your IT provider to update affected systems and check for compromise.","summary":"CVE-2026-20122 affects Cisco Catalyst SD-WAN Manager, formerly vManage, which organisations use to manage their networks. An attacker with a valid read-only account and API access can overwrite files and gain the privileges of the vmanage system account. Cisco released fixes in February and confirmed attacks in March. In May, Cisco Talos reported widespread exploitation involving this flaw and two others, with attackers installing backdoors, stealing credentials and mining cryptocurrency. Fixes remain available; older branches require migration. The reviewed sources do not establish that attacks have ended or give a total victim count. Cisco’s advisory rates the flaw high, at 7.1; NVD lists a different score of 5.4, medium.","action":"There is nothing to update on ordinary family devices. If your business or family office uses Cisco Catalyst SD-WAN Manager, ask its IT provider to install the appropriate fixed release below, restrict management access to trusted hosts and check for compromise using Cisco’s guidance.","product":"Cisco Catalyst SD-WAN Manager (formerly vManage)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-20122"],"tags":["cisco","sd-wan","network-management","file-overwrite","exploited"],"affected":["Earlier than 20.9: migrate to a fixed release","20.9 before 20.9.8.2","20.10 and 20.11: migrate to 20.12.6.1","20.12 before 20.12.5.3, and 20.12.6","20.13 and 20.14: migrate to 20.15.4.2","20.15 before 20.15.4.2","20.16: migrate to 20.18.2.1","20.18 before 20.18.2.1"],"fixed":["20.9.8.2","20.12.5.3","20.12.6.1","20.15.4.2","20.18.2.1"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Vulnerabilities","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","date":"2026-04-22"},{"kind":"research","title":"Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","date":"2026-05-14"},{"kind":"news","title":"Cisco flags more SD-WAN flaws as actively exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisco-flags-more-sd-wan-flaws-as-actively-exploited-in-attacks/","by":"BleepingComputer","date":"2026-03-05"},{"kind":"advisory","title":"Cisco security advisory (AV26-166) – Update 3","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166","by":"Canadian Centre for Cyber Security","date":"2026-04-20"},{"kind":"advisory","title":"CVE-2026-20122 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-20122","by":"NIST National Vulnerability Database","date":"2026-06-17"}],"started":"2026-04-20","closed":"2026-05-14","created":"2026-11-03T22:22:20.110Z","updated":"2026-11-03T22:22:20.110Z","cve_notes":[{"cve":"CVE-2026-20122","name":"Arbitrary file overwrite in Cisco SD-WAN Manager","what":"Incorrect file handling in Cisco Catalyst SD-WAN Manager’s API lets a remote attacker with read-only API credentials overwrite files and gain vmanage account privileges.","severity":"high","cvss":7.1}],"timeline":[{"at":"2026-05-14","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Cisco Talos reported widespread exploitation of unpatched systems during March and April, identifying ten clusters of malicious activity. Attackers installed backdoors, cryptocurrency miners and credential-stealing software.","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","patch":null},{"at":"2026-04-20","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-20122 to its Known Exploited Vulnerabilities catalogue, as confirmed by Canada’s Cyber Centre.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-18","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco added compromise indicators and the upgrade path for release 20.10 to its advisory.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","patch":null},{"at":"2026-03-05","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Cisco publicly confirmed active exploitation of CVE-2026-20122 and urged administrators to upgrade.","url":"https://www.bleepingcomputer.com/news/security/cisco-flags-more-sd-wan-flaws-as-actively-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-03-03","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Attackers were exploiting this flaw alongside two others and installing backdoors by at least this date, according to Cisco Talos’s subsequent investigation.","url":"https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/","by":"Cisco Talos","patch":null},{"at":"2026-02-25T16:00Z","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20122 and released software fixes. No workaround was available.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v","by":"Cisco","patch":"patched"}],"url":"https://hard.fyi/live/cisco-sdwan-manager-file-overwrite-feb-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-manager-file-overwrite-feb-2026"}